The Jolly Good Photo Co. is committed to protecting the privacy, security, and integrity of personal data. This Data Protection & GDPR Compliance Policy explains how we collect, process, store, and safeguard personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws.
By using our website or services, you acknowledge and agree to the practices described in this policy.
Data Controller
For the purposes of data protection legislation, The Jolly Good Photo Co. is the data controller responsible for the personal data we collect and process.
The Jolly Good Photo Co. operates as part of EL TORO Entertainment, which also delivers content creation services through In Reel Life. Personal data processed across these brands is handled in line with this policy unless stated otherwise.
Collection & Use of Personal Data
Purpose & Lawful Basis
We collect and process personal data solely where there is a lawful basis to do so.
These lawful bases include:
Personal data is processed only for purposes connected to the delivery, management, and improvement of our services.
Types of Personal Data
The personal data we may collect includes, but is not limited to:
Consent
Where consent is required as the lawful basis for processing, it will be obtained clearly and transparently. Individuals may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
Data Retention & Storage
Retention
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including contractual, legal, accounting, and regulatory requirements.
Once personal data is no longer required, it is securely deleted or anonymised.
Security Measures
We implement appropriate technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, or disclosure. These measures are reviewed regularly to ensure ongoing confidentiality, integrity, and availability of personal data.
Sharing of Personal Data
Third-Party Service Providers
We may share personal data with trusted third-party service providers where necessary to deliver our services.
This may include:
All third parties are contractually required to process personal data securely and only in accordance with our instructions.
Legal & Regulatory Disclosure
We may disclose personal data where required to do so by law or in response to valid legal or regulatory requests.
Rights of Data Subjects
Under UK GDPR, individuals have the right to:
Requests will be responded to within the timeframes required by law.
Individuals also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
International Data Transfers
Where personal data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards are in place to protect the data, such as adequacy regulations or approved contractual protections.
Data Breach Management
In the event of a personal data breach that poses a risk to individuals’ rights and freedoms, we will promptly assess the breach and notify the relevant supervisory authority and affected individuals where legally required.
Privacy by Design & DPIAs
We apply privacy by design and privacy by default principles when developing services and processes. Where required, Data Protection Impact Assessments (DPIAs) are conducted to identify and mitigate potential data protection risks.
Policy Updates
This policy may be updated from time to time to reflect changes in law or business practices. The most current version will always be published on our website.
Contact
If you have any questions about this policy or wish to exercise your data protection rights, please contact us at:
[email protected]
Last updated: January 2026
By using our website or services, you acknowledge and agree to the practices described in this policy.
Data Controller
For the purposes of data protection legislation, The Jolly Good Photo Co. is the data controller responsible for the personal data we collect and process.
The Jolly Good Photo Co. operates as part of EL TORO Entertainment, which also delivers content creation services through In Reel Life. Personal data processed across these brands is handled in line with this policy unless stated otherwise.
Collection & Use of Personal Data
Purpose & Lawful Basis
We collect and process personal data solely where there is a lawful basis to do so.
These lawful bases include:
- Performance of a contract
- Compliance with a legal obligation
- Legitimate business interests
- Consent, where required
Personal data is processed only for purposes connected to the delivery, management, and improvement of our services.
Types of Personal Data
The personal data we may collect includes, but is not limited to:
- Names
- Email addresses and telephone numbers
- Event details (such as date, venue, and service type)
- Billing and payment-related information
- Correspondence and communications
- We do not collect unnecessary or excessive personal data.
Consent
Where consent is required as the lawful basis for processing, it will be obtained clearly and transparently. Individuals may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
Data Retention & Storage
Retention
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including contractual, legal, accounting, and regulatory requirements.
Once personal data is no longer required, it is securely deleted or anonymised.
Security Measures
We implement appropriate technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration, or disclosure. These measures are reviewed regularly to ensure ongoing confidentiality, integrity, and availability of personal data.
Sharing of Personal Data
Third-Party Service Providers
We may share personal data with trusted third-party service providers where necessary to deliver our services.
This may include:
- Payment processors
- Online gallery and storage platforms
- Printing or production partners
- IT, hosting, and software providers
All third parties are contractually required to process personal data securely and only in accordance with our instructions.
Legal & Regulatory Disclosure
We may disclose personal data where required to do so by law or in response to valid legal or regulatory requests.
Rights of Data Subjects
Under UK GDPR, individuals have the right to:
- Request access to their personal data
- Request correction of inaccurate or incomplete data
- Request erasure of personal data
- Request restriction of processing
- Object to processing in certain circumstances
- Request data portability where applicable
- Withdraw consent where processing is based on consent
Requests will be responded to within the timeframes required by law.
Individuals also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
International Data Transfers
Where personal data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards are in place to protect the data, such as adequacy regulations or approved contractual protections.
Data Breach Management
In the event of a personal data breach that poses a risk to individuals’ rights and freedoms, we will promptly assess the breach and notify the relevant supervisory authority and affected individuals where legally required.
Privacy by Design & DPIAs
We apply privacy by design and privacy by default principles when developing services and processes. Where required, Data Protection Impact Assessments (DPIAs) are conducted to identify and mitigate potential data protection risks.
Policy Updates
This policy may be updated from time to time to reflect changes in law or business practices. The most current version will always be published on our website.
Contact
If you have any questions about this policy or wish to exercise your data protection rights, please contact us at:
[email protected]
Last updated: January 2026
